Analysis
-
max time kernel
149s -
max time network
130s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
16-01-2025 03:26
Behavioral task
behavioral1
Sample
c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
7 signatures
150 seconds
General
-
Target
c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf
-
Size
17KB
-
MD5
7047743c1c83a0795d0dca26866356f7
-
SHA1
a9460c8c41f103440b5073bc74b8bf1920c31629
-
SHA256
c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea
-
SHA512
96673f7f2faaa5b8cece9aec2dd6ed35af70e0f237a00806d155b14c6f617513ba539ccee32ac62743cc1005d0e3abc32d22468d570d9977382d10f843fbf39d
-
SSDEEP
384:MXVj+SEvm8rAKjYZuX4MIp3KcDjKeAY8E8eNkUpqTcQj0UXv1R9OTn:u+SjgX/mayjJd8INprUIn
Score
10/10
Malware Config
Extracted
Family
mirai
Botnet
LZRD
Signatures
-
Mirai family
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/watchdog c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for modification /dev/misc/watchdog c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf -
Traces itself 1 IoCs
Traces itself to prevent debugging attempts
pid Process 1562 c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf -
Enumerates running processes
Discovers information about currently running processes on the system
-
Writes file to system bin folder 2 IoCs
description ioc Process File opened for modification /sbin/watchdog c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for modification /bin/watchdog c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf -
description ioc Process File opened for reading /proc/608/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1220/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1235/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/700/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1111/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1160/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1178/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1201/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/741/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1167/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/639/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/991/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1036/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1166/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/520/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1164/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1191/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/523/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1074/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1149/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/867/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/990/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1168/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1057/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1226/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1128/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1356/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1560/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/410/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/587/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/871/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/962/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/983/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1273/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1503/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/611/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1016/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1350/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1450/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/585/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/746/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/774/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1432/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/856/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1559/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1144/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1567/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/417/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/613/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/666/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/827/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1041/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1198/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/633/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/634/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/745/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/767/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/770/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/723/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/737/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1176/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1242/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1306/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf File opened for reading /proc/1165/cmdline c9fd0cf82e10175573b4aecded601b4958954975a22ec48915ac61fc43db70ea.elf